@PouchXThank you for theese dumps. I'm sure I will extract lots of useful info about flash regions. I've seen NV in such dumps, so now I'm sure that NV is just a pice of flash, nothing more. I'm curious why are they so small? Where is file system located in flash?

You can make a search for a piece of code (such as "020000EA") and you will find fw_all.bin. You will find things the same way as they are saved using RGN_Tool. You will notice they are divided in 2048-byte chunks by the file system with FS information of 64 bytes in between the chunks. I was able to find the logo.bin for the nuvi 660. I could create logo.bin files for these units to be used with GIR_Editor.

quote:Originally posted by kunixI'm curious why are they so small? Where is file system located in flash?

These are only first MBs of whole flash that are enough to start unit when you will program blank flash chip. There is no need to program whole chip. Also, these dumps contains first sectors of file system. Some contains basic files like gmapbmap.img.. itc.N3xx/N6xx will start without any files.N2xx need few basic files.So, it depends on what unit you need to repair.For exmaple, you can flash N200 with N270 dump.But N270 boot looks for second flash chip on the PCB.http://www.garniak.pl/viewtopic.php?p=45511#p45511

@turbocccIndeed, flash is formatted in 2048-bytes data blocks with 64-bytes headers (or footers?). This looks strange to me. For the following reason. To execute firmware we need to make it contiguous in address space. I thought it's done with help of memory page mapping. But pages are larger that 64 bytes. So that's impossible. Moreover, I think firmware should be executed from flash directly. This is how (I suppose) it's usually made in embedded devices. So I have an idea that those 64-byte headers somehow are not visible for processor. Otherwise it's not possible to execute firmware from flash and firmware should be copied to RAM before execution.

Also did you notice that bootloader is contained 4 times in N670 flash? Maybe it's possible to choose from that 4 when booting device?

For performance, I am pretty sure the gps is running from ram not flash. Remember the program offset (ie 0x800080000) we discussed about a few weeks ago with little_frog? About boot: could be garmin boot, mass storage boot, ... I do not know, but yes I have seen a couple X-Loader strings.

@turbocccHuh, perfomance reasons.. good idea. But there are two facts that contradict it.1) it's not possible to write to firmware addresses while device is fully loaded (device crashes). Maybe it's some special MMU magic, but I didn't investigate deeper. Though I've seen a piece of code in the beginning of booloader that copies some bytes to fw_all addresses and executes them.2)it's not clear who does copying bootloader to RAM and execution it (because bootloader is definitely compiled to execute without that 64-byte headers)

What about 4 copies of booloader.This is not a bootloader from boot.bin, though it definitely looks like a piece of software. I met the booloader from boot.bin just one time. X-LOADER string is placed before any copy of a new strange bootloader. Don't know what this string is for...